Codemash CTF 2019 - Busted File

Clue

Hint

Have you heard of magic numbers?

Approach

Any time I get a file from a CTF, the first thing I do is open it in a hex editor. When opening this file I see that the first four bytes are DE AD BE EF, which is a classic magic number. Since I have worked with zip files in the past, I knew they started with PK and then a version number. A quick google search got me the right values. So I replaced the DE AD BE EF bytes with 50 4B 03 04 and was able to open the file.

This got us a smiling horse:

I opened this file with a hex editor and a search for the string cm, yields our flag: